Re: SSL requests crashes relayd with empty "return error style"

[Alexander Bluhm]

On Wed, Aug 30, 2017 at 09:20:40PM +1000, Jonathan Gray wrote:
> @@ -680,8 +680,9 @@ config_getproto(struct relayd *env, stru
>       s = sizeof(*proto);
>  
>       styl = IMSG_DATA_SIZE(imsg) - s;
> +     proto->style = NULL;
>       if (styl > 0) {

I think this chunk is the important part of the bugfix.  The
strndup(3) in get_string() creates a correct NUL termination in any
case.  A few lines above in config_gettable() I see a simmilar
problem.  So I would propose this fix instead.

bluhm

Index: config.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/relayd/config.c,v
retrieving revision 1.32
diff -u -p -r1.32 config.c
--- config.c    27 May 2017 08:33:25 -0000      1.32
+++ config.c    4 Sep 2017 12:31:48 -0000
@@ -343,7 +343,8 @@ config_gettable(struct relayd *env, stru
                        free(tb);
                        return (-1);
                }
-       }
+       } else
+               tb->sendbuf = NULL;
 
        TAILQ_INIT(&tb->hosts);
        TAILQ_INSERT_TAIL(env->sc_tables, tb, entry);
@@ -685,7 +686,8 @@ config_getproto(struct relayd *env, stru
                        free(proto);
                        return (-1);
                }
-       }
+       } else
+               proto->style = NULL;
 
        TAILQ_INIT(&proto->rules);
        proto->tlscapass = NULL;